Open Source Privacy Policy Generator
The name of this category is a little misleading, and it is worth saying plainly: the tools here do not draft your privacy policy text. They manage the other half of the compliance job, the cookie banner and the consent record that laws like the GDPR and ePrivacy demand before you load non-essential trackers. That distinction shapes the whole decision. A consent tool has to block scripts until a visitor agrees, prove they agreed, and let them change their mind later, all without piping every choice through a third-party platform. Running one from open source keeps the banner logic and the consent log on infrastructure you control, and lets you read exactly which trackers fire on which consent.
CookieConsent
Lightweight cookie-consent plugin in vanilla JavaScript for GDPR consent banners and settings
c15t
Developer-first cookie banner and consent management framework for web apps
Klaro!
Consent manager for website cookies and third-party apps, with configurable consent modes
tarteaucitron.js
GDPR-friendly cookie manager that blocks third-party services until the visitor consents
68publishers Cookie Consent
Cookie-consent widget with Google Tag Manager integration and standardized consent storage
Our picks
Pick by how hard you need to gate trackers and how much backend you run.
Best lightweight banner: CookieConsent CookieConsent is a plain-JavaScript banner and cookie-settings modal with no backend or account system. It ships as an npm package that you embed and serve yourself, so it runs entirely on your own site. The right pick when you need a clean, compliant notice without standing up consent infrastructure.
Best for gating scripts by purpose: Klaro! Klaro! is a consent management platform that blocks scripts, images, and stylesheets until the visitor agrees, and can show third-party apps individually or grouped by purpose. It keeps working even if JavaScript is disabled or Klaro itself is blocked, and a JavaScript API lets your code read and control consent. It self-hosts from files or npm.
Best for Google Consent Mode: tarteaucitron.js tarteaucitron.js disables all third-party services by default and loads each one only when the visitor clicks Allow, without reloading the page. A fallback can show a link or static banner in place of a blocked widget or ad. It integrates Google Consent Mode v2 and Bing Consent Mode, and is a script you host yourself.
Best developer-first CMP: c15t c15t is a headless consent framework that ships in your app bundle, not a third-party script, with a framework-agnostic core plus React and Next.js packages. A backend adds a consent policy engine, geo-location detection, and audit logging, with prebuilt scripts for GTM, GA4, and Meta Pixel. It runs on your own backend or a hosted cloud.
Choosing a consent manager, not a policy writer
Because none of these generate policy prose, the real choice is about how strictly you need to gate trackers and how much of a backend you want. At the light end, CookieConsent is a vanilla-JavaScript banner and settings modal with no backend or account, which suits a small site that mainly needs a compliant notice. tarteaucitron.js goes further by disabling every third-party service by default and loading each one only when the visitor clicks Allow, with a fallback that shows a link instead of a blocked social button.
For sites that manage many tools by purpose, Klaro! blocks scripts, images, and stylesheets until consent and can present apps individually or grouped, with a JavaScript API to read and control consent from your own code. If your stack runs on Google Tag Manager, 68publishers Cookie Consent provides a configurable GTM template and Google-standard consent storage. Teams that want consent handled inside the application rather than as a third-party script can reach for c15t, a headless framework with React and Next.js packages, a consent policy engine, geo-location detection, and audit logging.
Two practical points decide the fit. First, check whether the tool stores a durable, auditable consent record or only sets a cookie, since proving consent is a legal requirement, not a nicety; c15t adds audit logging, while lighter widgets store the choice client-side. Second, confirm the internationalization you need is present, because a banner has to speak your visitors' language to be valid consent. Most of these self-host from files or npm, so the banner and its log stay on your own site.
Related categories
Frequently asked questions
Do these tools write my privacy policy for me?+
No. Despite the category name, these are consent tools, not document generators. They show a cookie banner, collect the visitor's choices, and control which scripts load, but they do not produce the text describing what data you collect and why. You still need a privacy policy written from your actual data practices; these handle the banner and the consent that many laws require alongside that policy.
What is the difference between a cookie banner and a consent management platform?+
A banner is the visible notice and choice; a consent management platform, or CMP, adds the storage and control behind it. CookieConsent is essentially a client-side banner with a settings modal. Klaro! and c15t behave more like CMPs: they gate scripts by purpose, expose an API to read and change consent, and in c15t's case log consent server-side. If you must prove and manage consent over time, you want the CMP end of the range.
Which of these block trackers before consent instead of just showing a notice?+
That is the important capability, and not all of them do it the same way. tarteaucitron.js disables every third-party service by default and only loads each one when the visitor allows it. Klaro! holds back scripts, images, and stylesheets until consent, even if JavaScript is disabled or the tool itself is blocked. A banner that merely displays a notice while trackers already fired does not meet a prior-consent requirement.
Do I still need a written privacy policy if I use one of these?+
Yes. A consent banner and a privacy policy are separate obligations. The banner handles prior consent for cookies and trackers; the policy explains what personal data you collect, why, who receives it, and how people exercise their rights. These tools cover the first job well and none of them cover the second, so you still need a policy drafted from your real data practices and, where risk is material, reviewed by a lawyer.
How do these work with Google Tag Manager or Consent Mode?+
Several are built for it. 68publishers Cookie Consent ships a configurable Google Tag Manager template and consent storage types standardized by Google, and can trigger tags on consent. tarteaucitron.js integrates Google Consent Mode v2 and Bing Consent Mode. c15t includes prebuilt scripts for GTM, GA4, Meta Pixel, and more. If your analytics and ads run through GTM, confirm the tool maps consent to the exact tags you fire.
Do these keep a record that a visitor consented?+
It depends on the tool, and this is worth checking because proving consent is a legal requirement. Lighter widgets like CookieConsent store the visitor's choice in a cookie on their device. c15t adds server-side audit logging through its backend, and 68publishers can store consents through its consent management platform. If a regulator or complaint ever asks you to show that a specific visitor agreed, a durable log matters more than a client-side cookie.
Are these consent tools available in multiple languages?+
Mostly yes, which matters because consent is only valid if the visitor understands the banner. Klaro! ships full internationalization, tarteaucitron.js configures translations in JavaScript, 68publishers Cookie Consent includes translations for multiple locales and can load them from URLs, and c15t has built-in internationalization. Confirm your specific languages are covered, and that any custom service descriptions you add are translated too, not just the default strings.